• English

    • CocoaPods configuration

    OSA Proxy supports CocoaPods CDN, .podspec.json scanning, and downloaded archive scanning for source.http sources.

    OSA Proxy configuration

    cocoapods:
  enabled: true
  repository:
    - name: cocoapods
      registry: https://cdn.cocoapods.org
      scan-manifest: true
      scan-package: true
      work-mode: strict_wait
      additional-packages-registries:
        dl.google.com: https://dl.google.com

    The dl.google.com entry is only one possible host, not a complete list for cdn.cocoapods.org. CocoaPods CDN stores podspec metadata, but each pod author chooses the artifact address in the source field. Consequently, there is no fixed or exhaustive artifact host list, and the set can change over time.

    Use additional-packages-registries to map every source.http host used by pods allowed in your organization to its upstream base URL. For example, add example.com: https://example.com for https://example.com/releases/SDK.zip. OSA Proxy rewrites only source.http URLs from the listed hosts through its package scanning route. The git, svn, and hg sources, as well as unknown hosts, remain direct client downloads.

    List completeness

    If a host is absent from additional-packages-registries, CocoaPods downloads the artifact directly and OSA Proxy does not check it even when scan-package: true. Build the list from the podspecs of dependencies you use and update it when adding new pods or versions.

    Connecting CocoaPods

    Set the OSA Proxy route as a CDN source in the Podfile:

    source 'https://osa-proxy.example.com/cocoapods'

target 'ExampleApp' do
  pod 'Google-Mobile-Ads-SDK', '13.7.0'
end

    Then run the regular installation command:

    pod install --repo-update

    Blocking behavior

    The service CDN indexes CocoaPods-version.yml, all_pods.txt, and all_pods_versions_*.txt pass through OSA Proxy without scanning or modification. Manifest scanning occurs when a specific .podspec.json is requested.

    If a version is blocked by a CodeScoring policy, OSA Proxy blocks its .podspec.json response entirely. CocoaPods does not provide a compatible field that can mark a version as forbidden while leaving it available to the client. Therefore, remove-blocked-versions is not supported for CocoaPods, including the false mode.

    If the podspec is allowed and contains a source.http host from additional-packages-registries, OSA Proxy rewrites the URL through itself. With scan-package: true, the archive is checked before it is returned to CocoaPods.

    Was this page helpful?